Reject empty protocol id in HTTP/2 ALTSVC frames.

net/spdy/spdy_framer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_framer.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/third_party/valgrind/memcheck.h"
 #include "net/spdy/spdy_frame_builder.h"
@@ skipping 2038 matching lines @@
         SpdyFrameReader reader(current_frame_buffer_.get(),
                                current_frame_buffer_length_);
         reader.Seek(GetControlFrameHeaderSize());  // Seek past frame header.
         bool successful_read = reader.ReadUInt32(&altsvc_scratch_.max_age);
         reader.ReadUInt16(&altsvc_scratch_.port);
         reader.Seek(1);  // Reserved byte.
         successful_read = successful_read &&
                           reader.ReadUInt8(&altsvc_scratch_.pid_len);
         DCHECK(successful_read);
         // Sanity check length value.
-        if (GetAltSvcMinimumSize() + altsvc_scratch_.pid_len >=
-            current_frame_length_) {
+        if (altsvc_scratch_.pid_len == 0 ||
+            GetAltSvcMinimumSize() + altsvc_scratch_.pid_len >=
+                current_frame_length_) {
           set_error(SPDY_INVALID_CONTROL_FRAME);
           return 0;
         }
         altsvc_scratch_.protocol_id.reset(
             new char[size_t(altsvc_scratch_.pid_len)]);
       }
       processed_bytes += processing;
       continue;
     } else if (altsvc_scratch_.pid_buf_len < altsvc_scratch_.pid_len) {
       // Buffer protocol id field as in comes in.
@@ skipping 1208 matching lines @@
 #else
   WriteHeaderBlockToZ(&frame.name_value_block(), compressor);
 #endif  // defined(USE_SYSTEM_ZLIB)
 
   int compressed_size = compressed_max_size - compressor->avail_out;
   builder->Seek(compressed_size);
   builder->RewriteLength(*this);
 }
 
 }  // namespace net